Internet usage monitoring generally involves intercepting traffic that is exchanged between a monitored client and one or more content sources to monitor Internet usage associated with the client. For example, HyperText Transfer Protocol (HTTP) traffic that is exchanged between a monitored client, such as a web browser, web app, etc., and a content source, such as a web site, can be intercepted (e.g., at a proxy server) and processed to ascertain which content source(s) (e.g., sites) were visited by the user of the monitored client, which content was retrieved and presented by the monitored client, how the monitored client was used to interact with the content source(s), etc. Prior Internet usage monitoring techniques are able to ascertain such Internet usage characteristics from the intercepted HTTP traffic because HTTP traffic is unencrypted (e.g., plaintext) and, thus, the information conveyed by the HTTP traffic can be readily interpreted and analyzed.